Salesforce Audit Logs (via Codeless Connector Framework)

Connect Salesforce to Microsoft Sentinel

Follow [Create a Connected App in Salesforce for OAuth](https://help.salesforce.com/s/articleView?id=platform.ev_relay_create_connected_app.htm&type=5) and [Configure a Connected App for the OAuth 2.0 Client Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_client_credentials_setup.htm&type=5) to create a Connected App with access to the Salesforce Service Cloud API. Through those instructions, you should get the Consumer Key and Consumer Secret. For Salesforce Domain name, Go to Setup, type My Domain in the Quick Find box, and select My Domain to view your domain details. Make sure to enter the domain name without a trailing slash (e.g., https://your-domain.my.salesforce.com). Fill the form below with that information.

**Solution version 3.6.0 and later uses the Salesforce Audit logs V2 tables. Please use updated parser for any existing queries. Refer to the release notes of the solution [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce%20Service%20Cloud/ReleaseNotes.md)**

Manage Salesforce Connections

Add, view, and delete Salesforce connections

Add Connection

Configure API Connection

Base Configuration

Configure your Salesforce API connection

Connection Alias

Enter a unique alias to identify this Salesforce connection. **Important**: Use different aliases for each domain. To update an existing connection, use the same alias or delete and create with the same alias. To replace a connection, delete the old one and create a new one with a new alias.

Query interval (in minutes)

5

10

15

20

30

60

Salesforce Base URL

Enter the base URL of your Salesforce instance without trailing slash (e.g., https://your-domain.my.salesforce.com)

Data Types

Setup Audit Trail - Administrative changes and configurations

Login History - User login events and authentication

OAuth2 Credentials

Configure OAuth2 credentials for API access

The Salesforce connector supports two types of OAuth2 client credentials flow to authenticate with all API endpoints - Client Credentials and Username-Password. These credentials provide access to the selected data stream.

**Important:** For legacy or classic setup, ensure that the security token is appended to your password for the password-based grant type authentication to work. For lightning, passing just the password should work. For more information, refer to the [OAuth 2.0 Username-Password Flow for Special Scenarios](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_username_password_flow.htm&type=5).

Grant Type

Client Credentials

Consumer Key

Consumer Secret

Password

Consumer Key

Consumer Secret

Username

Password